{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Cisco ASA and FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls · updates",
  "home_page_url": "https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418",
  "feed_url": "https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418/feed.json",
  "description": "Cisco patched CVE-2026-76418 (CVSS 8.6), a denial-of-service bug in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. Logic errors when secondary authentication is configured on a tunnel group let an unauthenticated, remote attacker send a crafted request while connecting to the SSL VPN and make the device reload; a successful VPN login is not needed. Cisco PSIRT became aware of active exploitation in October 2026 and strongly recommends upgrading. Devices are affected when webvpn is enabled on an interface and a tunnel group (including DefaultWEBVPNGroup) uses secondary-authentication-server-group. There is no workaround, but disabling secondary authentication mitigates it. Shadowserver tracks more than 51,000 internet-exposed ASA SSL VPN devices.",
  "language": "en",
  "_pwn": {
    "slug": "cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418/feed.xml",
    "llms": "https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418/llms.txt",
    "json": "https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418#2026-10-29-2e62efe4",
      "url": "https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418#2026-10-29-2e62efe4",
      "title": "Cisco ASA and FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls: BleepingComputer reports the zero-day; Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices.",
      "content_text": "Cisco ASA and FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls: BleepingComputer reports the zero-day; Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices.\n\nSource: https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418#2026-10-28-4dc58249",
      "url": "https://pwn.watch/i/cisco-asa-ftd-ssl-vpn-dos-zero-day-cve-2026-76418#2026-10-28-4dc58249",
      "title": "Cisco ASA and FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls: Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 with fixed ASA and FTD releases, saying PSIRT became aware of active exploitation in October 2026.",
      "content_text": "Cisco ASA and FTD zero-day CVE-2026-76418 exploited to crash SSL VPN firewalls: Cisco publishes advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 with fixed ASA and FTD releases, saying PSIRT became aware of active exploitation in October 2026.\n\nSource: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75",
      "date_published": "2026-10-28T00:00:00.000Z",
      "external_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75",
      "tags": [
        "high"
      ]
    }
  ]
}